diff options
| author | Daniel P. Berrange <berrange@redhat.com> | 2013-10-09 15:14:34 +0100 |
|---|---|---|
| committer | Daniel P. Berrange <berrange@redhat.com> | 2013-10-21 14:03:52 +0100 |
| commit | b7fcc799ad5d8f3e55b89b94e599903e3c092467 (patch) | |
| tree | 1cbb288edd4142072d20ae676bf4e048d1a210ea /tools | |
| parent | 8c3586ea755c40d5e01b22cb7b5c1e668cdec994 (diff) | |
| download | libvirt-b7fcc799ad5d8f3e55b89b94e599903e3c092467.tar.gz | |
Close all non-stdio FDs in virt-login-shell (CVE-2013-4400)CVE-2013-4400-2
We don't want to inherit any FDs in the new namespace
except for the stdio FDs. Explicitly close them all,
just in case some do not have the close-on-exec flag
set.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/virt-login-shell.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index c754ae4bf9..01969506c2 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -313,6 +313,18 @@ main(int argc, char **argv) if (cpid == 0) { pid_t ccpid; + int openmax = sysconf(_SC_OPEN_MAX); + int fd; + if (openmax < 0) { + virReportSystemError(errno, "%s", + _("sysconf(_SC_OPEN_MAX) failed")); + return EXIT_FAILURE; + } + for (fd = 3; fd < openmax; fd++) { + int tmpfd = fd; + VIR_MASS_CLOSE(tmpfd); + } + /* Fork once because we don't want to affect * virt-login-shell's namespace itself */ |